COPPA Compliance

Identity verification via trusted and verified data sources in the United States specifically designed for COPPA compliance.

Overview

The COPPA Compliance service verifies that a target is a real, identifiable adult so you can obtain Verifiable Parental Consent (VPC) under the Children's Online Privacy Protection Act (COPPA). Before a child can use your service, COPPA requires you to confirm that the person providing consent is the parent or guardian — an adult — and this service performs that adult identity verification against trusted and verified data sources.

Under the FTC Safe Harbor Guidelines, a transaction passes only when we can:

• Locate the target in trusted and verified data sources

• Confirm the target is not deceased

• Confirm the target is 18 or older

• Confirm the target has provided an accurate SSN variable

You send the target's identity attributes in a single HTTPS POST request and receive a synchronous response in 2–3 seconds containing a result object with action, detail, and issues fields.

SSN variable

Every request must include the target's SSN in one of three formats:

Format	Description
Full 9 SSN	The complete nine-digit SSN.
Last 4 SSN	The last four digits of the SSN.
IDR Calc	Veratad's patented process — the user sums at least two digits of their SSN to prove they know it, without collecting sensitive PII. See IDR Calc below.

Service variants

This service is available in two variants. Both share the same endpoint, response objects, rulesets, and testing process; they differ only in the identity attributes you must send.

Variant	Locates the target using
IDMatchCOPPA5.0	Name + address + SSN variable (the base service)
IDMatchCOPPA5.0.NO.ADDRESS	Name + SSN variable + either Date of Birth or phone number

PRO TIP: The more data you send, the higher your success rate. The required inputs are the minimum needed to run a transaction, but sending everything you collect helps us locate the adult in the data sources and return a PASS. Add optional attributes beyond the minimum — for example, include the target's dob with the base IDMatchCOPPA5.0 service, or both phone and dob with the IDMatchCOPPA5.0.NO.ADDRESS variant — to maximize your match rate.

---

Endpoint

Both variants are served from the same endpoint:

POST https://production.idresponse.com/process/5/gateway

The service name you send in the request body (service) determines which variant runs.

---

IDMatchCOPPA5.0 (base service)

Locates the target by name and address, then validates the SSN variable.

Request

cURL

curl -X POST https://production.idresponse.com/process/5/gateway \
-H "Content-Type: application/json" \
-d '{
  "user": "USERNAME",
  "pass": "PASSWORD",
  "service": "IDMatchCOPPA5.0",
  "reference": "12345 {A UNIQUE ID}",
  "target": {
    "fn": "Barbara",
    "ln": "Miller",
    "addr": "123 Main St",
    "city": "Stratford",
    "state": "CT",
    "zip": "06614",
    "dob": "19740821",
    "ssn": "5698",
    "age": "18+",
    "test_key": "general_identity"
  }
}'

JSON

{
  "user": "USERNAME",
  "pass": "PASSWORD",
  "service": "IDMatchCOPPA5.0",
  "reference": "12345 {A UNIQUE ID}",
  "target": {
    "fn": "Barbara",
    "ln": "Miller",
    "addr": "123 Main St",
    "city": "Stratford",
    "state": "CT",
    "zip": "06614",
    "dob": "19740821",
    "ssn": "5698",
    "age": "18+",
    "test_key": "general_identity"
  }
}

Body parameters

Name	Type	Description
user*	string	Your account's API username
pass*	string	Your account's API password
service*	string	The service name (IDMatchCOPPA5.0)
reference	string	A unique identifier for your customer
target	object	The individual being sent for verification
fn*	string	The target's first name
ln*	string	The target's last name
addr*	string	The target's street address (line 1 and line 2)
city	string	The target's city
state	string	The target's state
zip*	string	The target's zip
dob	string	The target's Date of Birth (YYYYMMDD format)
ssn*	string	The target's SSN (Full 9, Last 4, or IDR Calc). See IDR Calc.
phone	string	The target's phone number
email	string	The target's email address
age*	string	The age to check (sent as "age+" — e.g. "18+", "21+")
test_key	string	The test key value that you are using to test

* Required.

Responses

200 PASS

{
  "meta": {
    "company": "Company ABC, Inc.",
    "confirmation": "21201890",
    "reference": "12345 {A UNIQUE ID}",
    "service": "IDMatchCOPPA5.0",
    "timestamp": "2020-08-08 17:56:14",
    "user": "[e-mail]"
  },
  "result": {
    "action": "PASS",
    "detail": "ALL CHECKS PASSED",
    "issues": []
  }
}

200 REVIEW

{
  "meta": {
    "company": "Company ABC, Inc.",
    "confirmation": "21201890",
    "reference": "12345 {A UNIQUE ID}",
    "service": "IDMatchCOPPA5.0",
    "timestamp": "2020-08-08 17:56:14",
    "user": "[e-mail]"
  },
  "result": {
    "action": "REVIEW",
    "detail": "TRANSACTION REQUIRES FURTHER ATTENTION",
    "issues": [
      "SSN CHECK FAILED"
    ]
  }
}

200 FAIL

{
  "meta": {
    "company": "Company ABC, Inc.",
    "confirmation": "21201890",
    "reference": "12345 {A UNIQUE ID}",
    "service": "IDMatchCOPPA5.0",
    "timestamp": "2020-08-08 17:56:14",
    "user": "[e-mail]"
  },
  "result": {
    "action": "FAIL",
    "detail": "TARGET IS UNDERAGE",
    "issues": []
  }
}

PRO TIP: Send a unique reference value with each request so you can reconcile the synchronous response back to the customer record in your own system.

---

IDMatchCOPPA5.0.NO.ADDRESS

A variant of the base service for cases where you cannot collect the target's street address. Instead of locating the target by address, it uses the SSN variable together with either a Date of Birth or a phone number.

Everything else — the endpoint, response objects, rulesets, and testing process — is identical to the base IDMatchCOPPA5.0 service. Only the required inputs differ, as described below.

Required inputs for this variant:

• First name (fn)

• Last name (ln)

• SSN variable (ssn — Full 9, Last 4, or IDR Calc)

• At least one of the following:

  • Date of Birth (dob)

  • Phone number (phone)

You do not need to send addr, city, state, or zip with this variant.

Request

cURL

curl -X POST https://production.idresponse.com/process/5/gateway \
-H "Content-Type: application/json" \
-d '{
  "user": "USERNAME",
  "pass": "PASSWORD",
  "service": "IDMatchCOPPA5.0.NO.ADDRESS",
  "reference": "12345 {A UNIQUE ID}",
  "target": {
    "fn": "Barbara",
    "ln": "Miller",
    "dob": "19740821",
    "ssn": "5698",
    "age": "18+",
    "test_key": "general_identity"
  }
}'

JSON

{
  "user": "USERNAME",
  "pass": "PASSWORD",
  "service": "IDMatchCOPPA5.0.NO.ADDRESS",
  "reference": "12345 {A UNIQUE ID}",
  "target": {
    "fn": "Barbara",
    "ln": "Miller",
    "dob": "19740821",
    "ssn": "5698",
    "age": "18+",
    "test_key": "general_identity"
  }
}

Body parameters

Name	Type	Description
user*	string	Your account's API username
pass*	string	Your account's API password
service*	string	The service name (IDMatchCOPPA5.0.NO.ADDRESS)
reference	string	A unique identifier for your customer
target	object	The individual being sent for verification
fn*	string	The target's first name
ln*	string	The target's last name
ssn*	string	The target's SSN (Full 9, Last 4, or IDR Calc). See IDR Calc.
dob†	string	The target's Date of Birth (YYYYMMDD format). Required if phone is not sent.
phone†	string	The target's phone number. Required if dob is not sent.
email	string	The target's email address
age*	string	The age to check (sent as "age+" — e.g. "18+", "21+")
test_key	string	The test key value that you are using to test

* Required. † You must send at least one of dob or phone.

Responses

Response objects are identical to the base service. See Response reference for all possible action, detail, and issues values.

---

Response reference

REVIEW does not mean PASS. Only a PASS action confirms a verified adult. If a transaction returns anything other than PASS — including REVIEW or FAIL — treat the target as not verified and do not consider them verified for COPPA VPC (Verifiable Parental Consent) purposes.

Action and detail

The following are all values that will be returned in the result object of the response.

Action	Detail	Description
FAIL	NO MATCH	No matching identity found in the data sources
FAIL	TARGET IS DECEASED	Target found as a deceased identity
FAIL	MINOR SUBMITTED	The DOB submitted for the target is under 18
FAIL	TARGET IS UNDERAGE	The target's DOB was found on file and is under 18
FAIL	POSSIBLE MINOR	Multiple DOBs are on file, at least one is under 18, and we could not determine which one belongs to the target
FAIL	AGE NOT VERIFIED	No DOB was on file for this individual, so we could not verify their age
REVIEW	TRANSACTION REQUIRES FURTHER ATTENTION	Target found and not deceased, but at least one identity attribute provided does not match. For this service, the only issue will be SSN CHECK FAILED.
PASS	ALL CHECKS PASSED	Target was found, is not deceased, and has passed all verification checks

Issues

When a transaction returns REVIEW, the response includes a list of issues. This list can contain any of the values below.

Issue	Description
SSN CHECK FAILED	The SSN provided does not match any on file

---

Rules

Both variants process with the same default base ruleset:

The base ruleset will return a PASS when:

• A match is found

• The target is not deceased

• The target is 18+

• The target has provided an accurate SSN value

The base ruleset will return a REVIEW when:

• A match is found

• The target is not deceased

• The target is 18+

• The target did not provide an accurate SSN value

The base ruleset will return a FAIL when:

• A match is not found

• The target is deceased

• The target could not be confirmed as 18+

---

IDR Calc

IDR Calc is Veratad's patented process that lets the user sum at least two digits of their SSN to prove they know it, without collecting sensitive PII. Instead of sending an ssn value, send the dcalc_mask and dcalc_answer attributes.

{
  "user": "USERNAME",
  "pass": "PASSWORD",
  "service": "IDMatchCOPPA5.0",
  "reference": "12345 {A UNIQUE ID}",
  "target": {
    "fn": "Barbara",
    "ln": "Miller",
    "addr": "123 Main St",
    "city": "Stratford",
    "state": "CT",
    "zip": "06614",
    "dob": "19740821",
    "dcalc_mask": "100000001",
    "dcalc_answer": "16",
    "age": "18+",
    "test_key": "general_identity"
  }
}

Attribute	Description
dcalc_mask	Tells the system which digits you asked the customer to sum. Place a 1 in each position you summed and a 0 in every other position.
dcalc_answer	The sum the user entered.

---

Testing

Use the test_key attribute to test the service. When test_key is provided, the system automatically bypasses the live data sources and queries the testing database instead. These transactions are free of charge — to access live data, do not send this attribute.

Test Cases